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Foreword 



rd , 



This Technical Specification (TS) has been produced by the 3 Generation Partnership Project (3GPP). 

The present document defines the requirements for TE-MT interworking over the R-reference point for the Packet 
Domain, within the GSM and 3GPP systems. 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 



The present document defines the requirements for TE-MT interworking over the R-reference point for the Packet 
Domain, within the GSM and 3GPP systems. It is up to the manufacturer how to implement the various functions but 
the present document and existing 3GPP TS 27.001, 27.002, and 27.003 shall be followed where applicable. 

It is the intention that the present document shall remain as the specification to develop a MS for support of Packet 
Switched services and its text includes references to UMTS/GSM standards. 
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Scope 



The UMTS/GSM PLMN supports a wide range of voice and non-voice services in the same network. In order to enable 
non-voice traffic in the PLMN there is a need to connect various kinds of terminal equipments to the Mobile Station 
(MS). The present document defines the requirements for TE-MT interworking over the R-reference point for the 
Packet Domain , including the protocols and signalling needed to support Packet Switched services, as defined in 3GPP 
TS 22.060 and 3GPP TS 23.060. 



References 



The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. 
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[2] 3GPP TS 22.002: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; Circuit Bearer Services (BS) supported by a GSM Public Land Mobile 
Network (PLMN)". 

[3] 3GPP TS 22.060: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; General Packet Radio Service (GPRS); Service Description Stage 1". 

[4] 3GPP TS 23.002: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; Network architecture". 

[5] 3GPP TS 23.003: "3rd Generation Partnership Project; Technical Specification Group Core 

Network; Numbering, addressing and identification". 

[6] 3GPP TS 03.10: "GSM PubUc Land Mobile Network (PLMN) connection types". 

[7] 3GPP TS 23.122: "3rd Generation Partnership Project; Technical Specification Group Core 

Network; NAS Functions related to Mobile Station (MS) in idle mode". 

[8] 3GPP TS 23.040: "3rd Generation Partnership Project; Technical Specification Group Terminals; 

Technical realization of the Short Message Service (SMS)". 

[9] 3GPP TS 23.060: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; General Packet Radio Service (GPRS) Service Description Stage 2". 

[10] 3GPP TS 04.02: "GSM Public Land Mobile Network (PLMN) access reference configuration". 

[II] 3GPP TS 24.007: "3rd Generation Partnership Project; Technical Specification Group Core 
Network; Mobile radio interface signalling layer 3; General aspects". 

[12] 3GPP TS 24.008: "3rd Generation Partnership Project; Universal Mobile Telecommunications 

System; Technical; Mobile radio interface layer 3 specification. Core Network Protocols - Stage 

3". 

[13] 3GPP TS 04.60: "General Packet Radio Service (GPRS); Mobile Station (MS) - Base Station 

System (BSS) interface; Radio Link Control / Medium Access Control (RLC/MAC) protocol". 

[14] 3GPP TS 04.64: "General Packet Radio Service (GPRS); Logical Link Control (LLC)" . 
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[15] 3GPP TS 24.065: "3rd Generation Partnership Project; Technical Specification Group Core 

Network; General Packet Radio Service (GPRS); Mobile Station (MS) - Serving GPRS Support 
Node (SGSN); Subnetwork Dependent Convergence Protocol (SNDCP)". 

[16] 3GPP TS 27.007: "3rd Generation Partnership Project; Technical Specification Group Terminals; 

AT command set for 3GPP User Equipment (UE)". 

[17] 3GPP TS 29.061: "3rd Generation Partnership Project; Technical Specification Group Core 

Network; Packet Domain; Interworking between the Public Land Mobile Network (PLMN) 
supporting Packet Based Services and Packet Data Networks (PDN)". 

[18] ITU-T Recommendation E.164: "Numbering plan for the ISDN era". 

[19] ITU-T Recommendation V.42 bis: "Data communication over the telephone network - Data 

compression procedures for data circuit-terminating equipment (DCE) using error correction 
procedures". 

[20] <V01D> 

[21] <V01D> 

[22] <V01D> 

[23] <VOID> 

[24] <V01D> 

[25] <V01D> 

[26] IETF RFC 768 (1980): "User Datagram Protocol" (STD 6). 

[27] IETF RFC 791 (1981): "Internet Protocol" (STD 5). 

[28] IETF RFC 792 (1981): "Internet Control Message Protocol" (STD 5). 

[29] IETF RFC 793 (1981): "Transmission Control Protocol" (STD 7). 

[30] ITU-T Recommendation V.250 (ex V.25ter): "Serial asynchronous automatic dialling and 

control". 

[31] ITU-T Recommendation V.24: "List of definitions for interchange circuits between data terminal 

equipment (DTE) and data circuit-terminating equipment (DCE)". 

[32] ITU-T Recommendation V.28: "Electrical Characteristics for unbalanced double-current 

interchange circuits". 

[33] ITU-T Recommendation V.80: "In-band DCE control and synchronous data modes for 

asynchronous DTE". 



[34] IETF RFC 1661 (1994 

[35] IETF RFC 1662(1994 

[36] IETF RFC 1700(1994 

[37] IETF RFC 1570(1994 

[38] IETF RFC 1989 (1996 

[39] IETF RFC 1332(1992 
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: "PPP in HDLC-like framing" (STD 51). 

: "Assigned Numbers" (STD 2). 

: "PPP LCP Extensions". 

: "PPP Link Quahty Monitoring". 

: "The PPP Internet Protocol Control Protocol (IPCP)". 

: "PPP IPCP Extensions for Name Server Addresses ". 
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[44] 
[45] 
[46] 
[48] 
[49] 



IETF RFC 2686 (1999): "The Multi-Class Extension to Multi-Link PPP" 

IETF RFC 1990 (1996): "The PPP Multilink Protocol (MP)". 

IETF RFC 2472 (1998): "IP Version 6 over PPP". 

3GPPTS 23.221: "Architectural requirements". 

IETF RFC 2373 (1998): "IP version 6 Addressing Architecture". 



3.1 



Definitions abbreviations and symbols 



Definitions 



For the purposes of the present document, the following terms and definitions given in 3GPP TS 22.060 and 3GPP TS 
23.060 and the following apply: 

2G- / 3G-: prefixes 2G- and 3G- refers to functionaHty that supports only GSM or UMTS, respectively, e.g., 2G-SGSN 
refers only to the GSM functionality of an SGSN. When the prefix is omitted, reference is made independently from the 
GSM or UMTS functionality. 



3.2 



Abbreviations 



For the purposes of the present document, the following abbreviations apply: 

APN Access Point Name 

GGSN Gateway GPRS Support Node 

GPRS General Packet Radio Service 

GSN GPRS Support Node 

GTP-U GPRS Tunnelling Protocol for user plane 

HDLC High Level Data Link Control 

ICMP Internet Control Message Protocol 

IETF Internet Engineering Task Force 

IP Internet Protocol 

IPv4 Internet Protocol version 4 

IPv6 Internet Protocol version 6 

IPV6CP IPv6 Control Protocol 

LA Location Area 

LCP Link Control Protocol 

LLC Logical Link Control 

MAC Medium Access Control 

MCML Multi-Class Multi-Link PPP 

ME Mobile Equipment 

MP Multilink PPP 

MS Mobile Station 

MT Mobile Termination 

NCP Network Control Protocol 

PDCP Packet Data Convergence Protocol 

PDN Packet Data Network 

PDP Packet Data Protocol , e.g., IP or PPP 

PDU Protocol Data Unit 

PPP Point-to-Point Protocol 

PS Packet Switched 

PTM Point To Multipoint 

PTP Point To Point 

PVC Permanent Virtual Circuit 

RA Routing Area 

SGSN Serving GPRS Support Node 

SNDCP SubNetwork Dependent Convergence Protocol 
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TCP 
TE 

TFT 
UDP 



Transmission Control Protocol 
Terminal Equipment 
Traffic Flow Template 
User Datagram Protocol 



3.3 Symbols 

For the purposes of the present document, the following symbols apply: 



Gb 
Gi 
Gn 
Gp 

Gs 
lu 
R 

Um 



Uu 



Interface between a SGSN and a BSC. 

Reference point between the Packet Domain and an external packet data network. 

Interface between two GSNs within the same PLMN. 

Interface between two GSNs in different PLMNs. The Gp interface allows support of Packet 

Domain network services across areas served by the co-operating PLMNs. 

Interface between an SGSN and MSC. 

Interface between the RNS and the core network. It is also considered as a reference point. 

The reference point between a non-ISDN compatible TE and MT. Typically this reference point 

supports a standard serial interface. 

The interface between the MS and the GSM fixed network part. The Um interface is the GSM 

network interface for providing packet data services over the radio to the MS. The MT part of the 

MS is used to access the GSM services through this interface. 

Interface between the mobile station (MS) and the UMTS fixed network part. The Uu interface is 

the UMTS network interface for providing packet data services over the radio to the MS. The MT 

part of the MS is used to access the UMTS services through this interface. 



Access reference configuration 



Figure 1 shows the relationship between the MS, its terminal equipment and the UMTS/GSM network in the overall 
Packet Domain environment. 



R 

reference point 



Um or Uu 



Gi 

reference point 



TE 



MT 



Packet Domain 
network 1 



MS 




Packet Domain 
jietwork2_ 

Figure 1 : Packet Domain Access interfaces and Reference Points 
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5 Functions to support data services 

The main functions of the MX to support data services are: 
physical connection at the reference point R; 
flow control between TE and MT; 

mapping of user signalling to/from the Packet Domain bearer; 
mapping of packets belonging to different flows to appropriate PDP contexts; 
support of data integrity between the terminal equipment and the Packet Domain bearer; 
functions to support packet based data. 

6 Interface to Packet Domain Bearer Services 



6.1 



GSIVI 



The following figure 2 shows the relationship of the GSM Packet Domain Bearer, terminating at the SNDCP layer, to 
the rest of the GSM Packet Domain environment. It is shown for reference purposes only and detailed information can 
be found in 3GPP TS 23.060. 
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Figure 2: User Plane for Packet Domain services in GSIVI 



6.2 



UIVITS 



The following figure 2a shows the relationship of the UMTS Packet Domain Bearer, terminating at the PDCP layer, to 
the rest of the UMTS Packet Domain environment. It is shown for reference purposes only and detailed information can 
be found in 3GPP TS 23.060. 
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Figure 2a: User Plane for Packet Domain services in UIVITS 



Gi 



7 



Functions common to all configurations of a MS 
supporting Packet Switched Services 



7.1 Mobile Station Modes of Operation 

Three GSM MS modes of operation are identified: Class A, B, and C. These modes of operation are described in 3GPP 
TS 23.060. 

Three UMTS MS modes of operation are supported in UMTS: A PS/CS mode of operation corresponds to class- A 
mode of operation in GSM. A PS mode of operation corresponds to class-C mode of operation in GSM. A CS mode of 
operation is out of scope in the present document. 

7.2 Physical Interface 

The physical interface between the TE and the MT may conform to ITU-T V.24/V.28, or to IrDA IrPHY physical 
standard specification, or to PCMCIA PC-Card electrical specification. All signal levels and their operation shall be as 
specified in 3GPP TS 27.001, 27.002, and 27.003. 

7.3 Terminal context procedures 

This subclause describes the relationships for PS Attach and Detach, and PDP Context Activation, Modification and 
Deactivation. The procedures for these functions are described in 3GPP TS 23.060. 



7.3.1 



PS Attach 



The PS Attach shall be performed prior to activating a PDP context. The PS Attach may be performed automatically or 
manually depending on the manufacturer' s implementation and configuration. 

7.3.2 PS Detach 

The PS Detach may be performed automatically or manually depending on the manufacturer's implementation and 
configuration. The following cases are valid: 

if the connection between the TE and MT is broken then the MT may perform the PS Detach procedure; 

if the network originates a PS Detach the MT may inform the TE; 

if the radio connection is broken then the MT may inform the TE; 
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if the TE deactivates the last PDP context then the MT may perform the PS Detach procedure. 

7.3.3 MS Originated PDP Context Activation 

The PDP Context Activation procedure may be performed automatically or manually depending on the manufacturer's 
implementation and configuration. Depending on the manufacturer's implementation and configuration, 0, 1, or more 
PDP contexts can be active simultaneously. 

7.3.4 MS Originated Secondary PDP Context Activation 

The Secondary PDP Context Activation procedure may be performed automatically or manually depending on the 
manufacturer's implementation and configuration. Depending on the manufacturer's implementation and configuration, 
0, 1, or more PDP contexts can be active simultaneously for the same PDP address. 

7.3.5 Networl< Requested PDP Context Activation. 

The network can request a PS attached MS to activate a specific PDP context. 

7.3.6 MS-lnitiated PDP Context Modification 

The MS -Initiated PDP Context Modification procedure may be performed automatically or manually depending on the 
manufacturer's implementation and configuration. 

7.3.7 PDP Context Deactivation 

The PDP Deactivation may be performed automatically or manually depending on the manufacturer's implementation 
and configuration. The following cases are valid: 

if the connection between the MT and the TE is broken then the MT may perform the PDP Context Deactivation 
procedure; 

if the radio connection is broken then the MT may inform the TE; 

if the DHCP lease expires or the renewal is rejected by the DHCP server or the IP Address is changed during 
DHCP lease renewal, the TE may deactivate the PDP context. 

if the TE deactivates the last PDP context then the MT may perform the PS Detach procedure. 

7.3.8 PDP context related parameters 
7.3.8.1 MS in A/Gb mode 

It shall be possible to enquire and/or set the following parameters: 
requested quality of service; 
traffic flow template; 
compression on or off; 
TCP/IP header compression on or off; 

- PDP address; 

- PDP type; 

- Access Point Name (APN); 

protocol configuration options (if required by the PDP type). 
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7.3.8.2 MS in lu mode 

It shall be possible to enquire and/or set the following parameters: 
requested quality of service; 
traffic flow template; 

protocol control information compression, on or off; 
PDP address; 

- PDP type; 

- Access Point Name (APN); 

protocol configuration options (if required by the PDP type). 



8 



<VOID> 



9 IP Based Services 

All protocols that are supported by the underlying IP protocol are applicable in the Packet Domain environment. 
However there may be some limitations due to the RF environment. 

The IP protocol can be run over various underlying protocols as shown in the figure 6. 
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Figure 6: IP Based Services 

PPP is a widely supported protocol in numerous operating systems and this alleviates the need for any Packet Domain 
specific protocol at the TE. PPP at the MT shall comply with the following specifications IETF STD 51 (RFC 1661, 
RFC 1662), RFC 1570, RFC 1989, RFC 1332 for IPv4, and optionally RFC 2472 for IPv6. Additionally for IPv4 any 
Domain Name Server information shall be delivered as defined in RFC 1877, and the delivery of any vendor-specific 
packets and options shall conform to RFC 2153. 

As an alternative to PPP, an L2 protocol can be used which is defined as a manufacturer's operating system dependent 
protocol capable of carrying IP frames over the R reference point. An example for such an L2 protocol is the Multi- 
Class Multi-Link (MCML) PPP. The MCML is defined in RFC 2686 and is based on Multi-Link (MP) PPP which is 
defined in RFC 1990. For IPv6 the L2 protocol shall support negotiation of the IPv6 Interface-Identifier between the TE 
and the MT. 

With IPv6, the process of setting up the IP connectivity is somewhat different than with IPv4 as it involves two distinct 
signalling phases. The first signalling phase is done in the control plane, followed by a second signalling phase done in 
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the user plane. The control plane signalling phase, in the case of IPv6 over PPP, is described in section 9.1.2. The user 
plane signalling phase can be either stateless or stateful and is described in 3GPP TS 29.061 [17]. Support of the stateful 
address autoconfiguration procedure in the MS is optional. 

Stateful and Stateless Autoconfiguration may also co-exist. In that case, the MS shall use Stateless to configure the 
address and Stateful to configure additional parameters only. The MS shall not use Stateless and Stateful Address 
Autoconfiguration simultaneously since GPRS only supports one prefix per PDP Context (see 3GPP TS 29.061 [17]). 

Besides what is specified in the present document and in 3GPP TS 29.061, an MS supporting IPv6 shall comply with 
the guidelines specified in 3GPP TS 23.221 [48], subclause "UE support of IPv6". 



9.1 Example mapping of functions between the R reference 
point and the Packet Domain bearer for IP over PPP 

The following examples illustrate the case when the IP over PPP functionality is used in the MT. The example does not 
include all the details of PPP, but only describes the logical operation of PPP connection establishment, host 
authentication and IP configuration. 

Each interface at the R reference point can support only one PPP connection and each PPP connection can support only 
one IP session. Therefore, in PPP mode only one IP PDP context can be activated per interface at the R reference point. 
However, it is possible for a PCMCIA card (or other multiplexed interfaces) to support multiple virtual interfaces 
(communications ports) at the R reference point. Multiple PPP connections and IP contexts are possible in this case. 



9.1.1 



IPv4 over PPP 

TE R 



MT 



Um/Uu 



1 
1 
1 
1 
1 

1. ATcommarjid 




2. AT response 




3. LCP Confiqure-Request 




4. LCP Configure Ack 




5. LCP Confiture-Request 




6. LCP ConfigLire Ack 




7. Host autlner|tication 




8. NCP Confiture-Request 


9. PS Attacin 


1 1 . NCP Configure Ack 


1 0. PDP contekt Activation 









Figure 7a: IPv4 Over PPP Based Service 

1) The TE issues AT commands to set up parameters and enter PPP mode (refer to subclause on AT commands for 
further details). 
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2) The MT sends AT responses to the TE. 

3) The PPP protocol in the TE sends a LCP Configure-Request. This command is to estabHsh a PPP link between 
the TE and the MT. 

4) The MT returns LCP Configure-Ack to the TE to confirm that the PPP link has been established. The MT might 
previously have sent a LCP Configure-Nak in order to reject some options proposed by the TE. This in turn 
might have triggered a retransmission of the LCP Configure-Request with different options. 

5) The PPP protocol in the MT sends a LCP Configure-Request in order to negotiate for the authentication protocol 
used for authentication of the host TE towards the MT. The MT shall initially negotiate for CHAP, and if this is 
unsuccessful, for PAP. 

6) The TE returns a LCP Configure-Ack to the MT to confirm the use of the specified authentication protocol. The 
MT might previously have sent a LCP Configure-Nak in order to reject the protocol proposed by the TE. This in 
turn might have triggered a retransmission of the LCP Configure-Request with different options. 

7) If the negotiated authentication protocol is either of CHAP or PAP, the TE authenticates itself towards the MT 
by means of that protocol. The MT stores the necessary authentication data and sends a locally generated 
positive acknowledgement of the authentication to the TE. If none of the protocols is supported by the host TE 
no authentication shall be performed. Refer to 3GPP TS 29.061 for further details on the authentication. 

8) The PPP protocol in the TE sends to the MT a NCP Configure-Request. This command activates the IP protocol. 

9) If the MS is not yet PS attached, the MT performs the PS Attach procedure as described in 3GPP TS 23.060. 

10) The MT performs a PDP Context Activation as described in 3GPP TS 23.60. IP configuration parameters may be 
carried between the MT and the network in the Protocol Configuration Options IE in PDP Context Activation 
messages. The Protocol Configuration Options IE sent to the network may contain zero or one NCP Configure- 
Request packet (in addition to any LCP and authentication packets). The Protocol Configuration Options IE 
received from the network may contain zero or one NCP Configure-Ack, zero or one Configure-Nak and/or zero 
or one Configure-Reject packets (in addition to any LCP and authentication packets). 

1 l)Based on the information received in the Protocol Configuration Options IE, the MT acknowledges to the PPP 
protocol in the TE that the IP protocol is now activated by sending a NCP Configure-Ack command. Before 
sending a NCP Configure-Ack, the MT might previously have sent a NCP Configure-Nak and/or Configure- 
Reject in order to reject some IP parameters proposed by the TE. This in turn might have triggered a 
retransmission of the NCP Configure-Request with different parameter values. The decision to reject a specific 
parameter or parameter value may be based on the information received from the network in the Protocol 
Configuration Options IE. NCP Configure-Ack may also carry IP protocol related parameters such as dynamic 
IP address to the TE. The MT shall also pass name server information to the TE if the TE has requested for it 
and if this information is provided by the GGSN. Other packet types and options may optionally be delivered. 
The MT may choose to immediately deactivate the PDP context due to the information received from the 
network in the Protocol Configurations Options IE. 
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9.1.2 IPv6 over PPP 
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Figure 7b: PDP Context Activation for the IPv6 over PPP based services 



1) The TE issues AT commands to set up parameters and enter PPP mode (refer to subclause on AT commands for 
further details). 

2) The MT sends AT responses to the TE. 

3) The PPP protocol in the TE sends a LCP Configure-Request. This command is to establish a PPP link between 
the TE and the MT. 

4) The MT returns LCP Configure-Ack to the TE to confirm that the PPP link has been established. The MT might 
previously have sent a LCP Configure-Nak in order to reject some options proposed by the TE. This in turn 
might have triggered a retransmission of the LCP Configure-Request with different options. 

5) The PPP protocol in the MT sends a LCP Configure-Request in order to negotiate for the authentication protocol 
used for authentication of the host TE towards the MT. The MT shall initially negotiate for CHAP, and if this is 
unsuccessful, for PAP. 
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6) The TE returns a LCP Configure-Ack to the MT to confirm the use of the specified authentication protocol. The 
MT might previously have sent a LCP Configure-Nak in order to reject the protocol proposed by the TE. This in 
turn might have triggered a retransmission of the LCP Configure-Request with different options. 

7) If the negotiated authentication protocol is either of CHAP or PAP, the TE authenticates itself towards the MT 
by means of that protocol. The MT stores the necessary authentication data and sends a locally generated 
positive acknowledgement of the authentication to the TE. If none of the protocols is supported by the host TE 
no authentication shall be performed. Refer to 3GPP TS 29.061 for further details on the authentication. 

8) The TE requests IPv6 Interface-Identifier negotiation by sending the IPV6CP Configure-Request message to the 
MT indicating the tentative Interface-Identifier chosen by the TE. The tentative Interface-Identifier has only 
local significance in the MT and shall not forwarded to the GGSN. 

9) If the MS is not yet PS attached, the MT performs the PS Attach procedure as described in 3GPP TS 23.060. 

10) The MT sends the Activate PDP context request message to the network, including the PDP Type, PDP Address 
and Protocol Configuration Options. The Protocol Configuration Options may contain negotiated LCP options 
such as negotiated Authentication Protocol as well as any authentication data previously stored in the MT. The 
MS shall leave PDP Address empty and set PDP Type to TPv6'. 

The network responds with an Activate PDP Context Accept or an Activate PDP Context Reject, to the MS. The 
PDP Address shall contain an IPv6 address composed of a Prefix and an Interface-Identifier. The size of the 
Prefix shall be according to the maximum prefix length for a global IPv6 address as specified in the IPv6 
Addressing Architecture, see RFC 2373 [49]. The Interface-Identifier shall be used to create a link-local IPv6 
address, to be used in continued MS - GGSN user-plane signalling. The Prefix in the PDP Address shall be 
ignored by the MS. 

1 l)In case a PDP Context Accept was sent to the MS, the MT extracts the Interface-Identifier from the address 
received in the PDP Address IE and ignores the Prefix part. If this Interface-Identifier is identical to the tentative 
Interface-Identifier indicated in the IPV6CP Configure-Request message sent from the TE, the MT sends an 
IPV6CP Configure Ack packet, indicating this Interface-Identifier, to the TE. 

If the Interface-Identifier extracted from the address contained in the PDP Address IE is not identical to the 
tentative Interface-Identifier indicated in the IPV6CP Configure-Request message sent from the TE, the MT 
sends an IPV6CP Configure Nak packet, indicating the Interface-Identifier extracted from the address contained 
in the PDP Address IE, to the TE. The TE then sends a new IPV6CP Configure-Request message to the MT, 
indicating the same Interface-Identifier as was indicated in the received IPV6CP Configure Nak. Finally the MT 
responds with an IPV6CP Configure Ack packet. The negotiated Interface-Identifier shall be used in the TE to 
create a link-local address. 

After finalisation of the IPV6CP negotiations between TE and MT, the user plane link is established. Before the 
MS can communicate with other hosts on the Intranet/ISP it shall obtain an IPv6 Global or a Site-Local Unicast 
address. Given that exactly one Prefix is included in the Router Advertisement, depending upon whether the 
advertised Prefix is globally unique or Site-local unique, the MS can only generate either IPv6 Global 
address(es) or Site-local address(es) using this Prefix during the lifetime of a particular PDP Context. This is 
done using either Stateless or Stateful Address Autoconfiguration as described in 3GPP TS 29.061 [17]. 

When creating a Global or Site-Local Unicast Address, the MS may use the Interface-Identifier received during 
the PDP Context Activation phase or it may generate a new Interface-Identifier. There is no restriction on the 
uniqueness of the Interface-Identifier of the Global or Site-Local Unicast Address, since the Prefix itself is 
unique. Interface-Identifiers shall in any case be 64-bit long and follow standard interface-identifier guidelines as 
per IETF RFC 2373 [49] and RFC 2472 [46]. 

In case a PDP Context Reject was sent to the MS the MT sends an LCP Terminate-Request to the TE, the TE 
and MT negotiate for link termination. The MT may then send a final AT-response to inform the TE about the 
rejected PDP Context activation. 



Note. When this version of this specification was released, work was still in progress within IETF for how to provide 
DNS configuration for MS not supporting Stateful Autoconfiguration, i.e. MS not supporting DHCP DNS 
configuration. 
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9.2 Example mapping of functions between the R reference 

point and the Packet Domain bearer for IP over MCML PPP 

When MCML is used instead of standard PPP [34] at the R-reference point, it is possible to support muhiple IP sessions 
on one MCML connection. This is achieved by using an additional MP header after the standard PPP header. MCML 
provides two different MP headers, a 2-byte header to have four IP sessions and a 4-byte header to have sixteen IP 
sessions multiplexed over the MCML connection. 

Since both MP and MCML closely follow the PPP connection establishment and negotiation model described in 
subclause 9.1, it is not replicated in this subclause. The major difference is the additional negotiation capabilities used 
during the LCP configuration negotiation [44], [45]. 
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10 



PPP Based Services 



By means of the PDP type 'PPP' the Packet Domain may support interworking with networks based on the point-to- 
point protocol (PPP), as well as with networks based on any protocol supported by PPP through one of its Network 
Control Protocols (NCPs). It may also support interworking by means of tunnelled PPP, by e.g. the Layer Two 
Tunnelling Protocol (L2TP). The protocol configurations are depicted in figures 8 a and 8b. 
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Figure 8a: PPP Based Services (transparent PPP negotiation) 
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NOTE. In the above case the 'L2' protocol is compliant with [35]. 

Figure 8b: PPP Based Services (relayed PPP negotiation) 

The 'L3' protocol is a network layer protocol supported by one of the PPP NCP's. All protocols currently supported by 

NCP's are listed in [36]. 

The PPP is a widely supported protocol in numerous operating systems and this alleviates the need for any Packet 
Domain specific protocol at the TE. PPP at the GGSN shall comply with [34]. The Domain Name Server information 
shall be delivered as defined in [40]. The delivery of any vendor-specific packets and options shall conform to [41]. 

The 'L2' protocol may be the link layer protocol defined for the PPP suite [35]. As an alternative an 'L2' protocol can be 
used which is defined as a manufacturer's operating system dependent protocol capable of carrying PPP frames over the 
R reference point. In case the link layer protocol defined for the PPP suite [35] is used as 'L2' protocol, the MT may 
negotiate LCP options related to the 'L2' framing (e.g. 'ACCM' [35], 'ACFC [34] and 'FCS-Alternatives' [37]), with the 
TE. The MT shall remove the 'LI' and 'L2' specific framing from PPP frames in the uplink direction and add it in the 
downlink direction (see figure 8b). 
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1 0.1 Example mapping of functions between the R reference 
point and the Packet Domain bearer (transparent PPP 
negotiation) 

The following example illustrates the case when the PPP negotiation is carried out transparently between the TE and the 
GGSN. The example does not include all the details of PPP, but only describes the logical operation of PPP LCP, host 
authentication and PPP NCP negotiations. 
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Figure 9a: PPP Based Service (transparent PPP negotiation) 

1) The TE issues AT commands to set up parameters and activate a PDP Context (refer to sub-clause on AT 
commands for further details). 

2) The MT performs a PDP Context Activation as described in 3GPP TS 23.060. 

3) The MT sends AT responses to the TE. 

4) The PPP protocol in the TE sends an LCP Configure-Request. This command establishes a PPP link between the 
TE and the GGSN. 

5) The GGSN returns an LCP Configure- Ack to the TE to confirm that the PPP link has been established. The 
GGSN might previously have sent an LCP Configure-Nak in order to reject some options proposed by the TE. 
This in turn might have triggered a retransmission of the LCP Configure-Request with different options. 

6) The PPP protocol in the GGSN sends an LCP Configure-Request in order to negotiate for the authentication 
protocol used for authentication of the host TE towards the GGSN. 

7) The TE returns an LCP Configure-Ack to the GGSN to confirm the use of the specified authentication protocol. 
The GGSN might previously have sent an LCP Configure-Nak in order to reject the protocol proposed by the 
TE. This in turn might have triggered a retransmission of the LCP Configure-Request with different options. 
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8) The TE authenticates itself towards the GGSN by means of the negotiated protocol. If no authentication protocol 
can be negotiated the GGSN may reject the PPP connection. Refer to 3GPP TS 09.61 for further details on the 
authentication. 

9) The PPP protocol in the TE sends to the GGSN an NCP Configure-Request. This command activates the 
network layer protocol. 

10) The GGSN acknowledges to the PPP protocol in the TE that the network layer protocol is now activated by 
sending an NCP Configure-Ack command. Before sending an NCP Configure- Ack, the GGSN might previously 
have sent an NCP Configure-Nak in order to reject some parameters proposed by the TE. This in turn might have 
triggered a retransmission of the NCP Configure-Request with different parameter values. 

1 0.2 Example mapping of functions between the R reference 
point and the Packet Domain bearer (relayed PPP 
negotiation) 

The following example illustrates the case where the link layer protocol defined for the PPP suite [35] is used as 'L2' 
protocol. The LCP options related to the 'L2' framing (e.g. 'ACCM', 'ACFC and 'FCS-Alternatives') are negotiated 
between the TE and the MT. All other PPP negotiation is relayed transparently between the TE and the GGSN. The 
example does not include all the details of PPP, but only describes the logical operation of PPP LCP, host authentication 
and PPP NCP negotiations. 
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Figure 9b: PPP Based Service (relayed PPP negotiation) 

1) The TE issues AT commands to set up parameters and activate a PDP Context (refer to sub-clause on AT 
commands for further details). 

2) The MT performs a PDP Context Activation as described in 3GPP TS 23.060. 
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3) The MT sends AT responses to the TE. 

4) The PPP protocol in the TE sends an LCP Configure-Request. If the request contains options related to the 'L2' 
framing these are negotiated by the MT. The LCP Configure-Request shall subsequently be relayed to the 
GGSN. 

5) The GGSN returns an LCP Configure-Ack to the MT. The MT may change the value(s) of any options related to 
'L2' framing and thereafter return an LCP Configure-Ack to the TE to confirm that the PPP link has been 
established. The MT might previously have sent an LCP Configure-Nak to the TE in order to reject some options 
proposed by the TE. This in turn might have triggered a retransmission of the LCP Configure-Request with 
different options. 

6) The PPP protocol in the GGSN sends an LCP Configure-Request in order to negotiate for e.g. the authentication 
protocol used for authentication of the host TE towards the GGSN. The request is relayed to the TE. 

7) The TE returns an LCP Configure-Ack to the MT to confirm the use of e.g. the specified authentication protocol. 
The acknowledgement is relayed to the GGSN. The GGSN might previously have sent an LCP Configure-Nak in 
order to reject the protocol proposed by the TE. This in turn might have triggered a retransmission of the LCP 
Configure-Request with different options. 

8) The TE authenticates itself towards the GGSN by means of the negotiated protocol. The messages are relayed 
transparently by the MT. If no authentication protocol can be negotiated the GGSN may reject the PPP 
connection. Refer to 3GPP TS 29.061 for further details on the authentication. 

9) The PPP protocol in the TE sends an NCP Configure-Request to the MT, which relays it transparently to the 
GGSN. 

10) The GGSN acknowledges to the PPP protocol in the TE that the network layer protocol is now activated, by 
sending an NCP Configure-Ack command, transparently relayed by the MT. Before sending an NCP Configure- 
Ack, the GGSN might previously have sent an NCP Configure-Nak in order to reject some parameters proposed 
by the TE. This in turn might have triggered a retransmission of the NCP Configure-Request with different 
parameter values. 



1 1 Internet Hosted Octet Stream Service (IHOSS) 

Void. 



12 AT commands 



3GPP TS 27.007 defines commands that a TE may use to control a MT supporting Packet Switched services, via either 
a non-multiplexed character-stream interface or a mutliplexed character stream interface (27.010). A non-multiplexed 
character stream interface places certain limitations on the functionality of the interface. For example, it is not possible 
for the MT to send control information to the TE or for the TE to send commands to the MT whilst the interface is in 
the V.250 online data state unless the layer 2 protocol itself supports this feature. However, a manufacturer-specific 
escape mechanism may be provided to enable the TE to switch the MT into the V.250 online command state. It is 
anticipated that MTs will vary widely in functionality. At one extreme, a class A or PS/CS MT might support multiple 
PDP types as well as circuit switched data, and use multiple external networks and QoS profiles. At the other extreme a 
class C or PS MT might support only a single PDP type using a single external network, and rely on the HLR to contain 
the context definition. 

A comprehensive set of Packet Domain -specific AT commands is defined in 3GPP TS 27.007 to provide the flexibility 
needed by the more complex MT. The commands are designed to be expandable to accommodate new PDP types and 
interface protocols, merely by defining new values for many of the parameters. Multiple contexts may be activated if 
the interface link-layer protocol is able to support them. The commands use the extended information and error message 
capabilities described in 3GPP TS 27.007. 

For MTs of intermediate complexity, most commands have simplified forms where certain parameters may be omitted. 
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For the simplest MTs, and for backwards compatibility with existing communications software, it is possible to control 
access to the Packet Domain using existing modem-compatible commands. A special dial-string syntax is defined for 
use with the D command. This "modem compatible" mode of operation is described in 3GPP TS 27.007. 

Subclause 12.2 contains examples of command sequences for a number of applications. 

Annex A of the present document lists the AT commands for the Packet Domain. They are fully defined in 3GPP 
TS 27.007. 

12.1 General on AT commands 

The following subclauses describe how the AT commands are used for the Packet Domain. The AT commands 
themselves are fully described in 3GPP TS 27.007. Reference to the particular AT command names are shown only for 
clarity. In all case refer to 3GPP TS 27.007 for the latest descriptions. 

12.1.1 Interaction of AT commands, Packet Domain management and 
PDPs 

State machines may be used to describe the behaviour of: 

- AT commands (ITU-T V.250); 

- PDP context management (3GPP TS 23.060); 

PDP startup, data transfer and termination (Packet Data Protocol specifications); 

the layer 2 protocol (if any) used across the TE-MT interface (layer 2 protocol specifications). 

This subclause does not attempt to describe in detail how these state machines interact but rather to give some general 
guidance on their relationships. 

12.1.1.1 AT commands and responses 

AT commands may be issued and responses received by the TE only when the TE and MT are in V.250 command state. 

The possibility of suspending the PDP and/or layer 2 protocol and entering V.250 online command state is not 
considered here; neither is the use of a multiplexed interface where the PDP and the AT commands use separate logical 
channels. 

1 2.1 .1 .2 PDP and layer 2 protocol operation 

The PDP (across the TE-MT interface) may startup, transfer data and terminate only when the TE and MT are in V.250 
online data state. It may be necessary to startup a layer 2 protocol across the interface before starting the PDP. The PDP 
startup procedure may provide information needed for the PDP context activation procedure (see subclause 10.1.1.3.2). 

1 2.1 .1 .3 Management of Packet Switched services 

A particular PDP may be used to transfer data only when a context is active for that PDP. Before a context can be 
activated, the MT must be attached to the Packet Domain network. 

In order to provide flexibility and support a variety of types of MT and PDP, AT commands are provided which give 
the TE explicit control over attachment and detachment (h-CGATT), and context activation and deactivation (h-CGACT) 
procedures. These commands allow the TE to retain control of the MT, and receive status information from the MT, 
after these actions have been performed. 

12.1.1.3.1 PS attachment 

The MT may be attached and detached using the H-CGATT command. However, it may not be necessary to use the 
command since attachment may occur: 

on power up or reset; 
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when an attempt is made to activate a context either expHcitly (+CGACT) or as a result of a PDP startup - 
procedure; 

when the mobile class is changed (+CGCLASS). 

Similarly, detachment may occur: 

as a result of a PDP termination procedure (if no other Packet Switched services are active); 

when the mobile class is changed (+CGCLASS). 

12.1.1.3.2 PDP context activation 

Certain information must be provided to the network in order for a context activation attempt to be successful. The TE 
may provide some of this information to the MT during the PDP startup procedure rather than through AT command 
procedures. In this case the context activation cannot be initiated by the +CGACT command but rather on receipt of the 
appropriate information during the PDP startup. 

12.1.2 Use of default context parameter values 

The activate context request message sent by the MT to the network contains a number of parameters whose values can 
usefully be set by the TE. Under certain circumstances the values for some or all of the parameters need not be provided 
by the TE, either via AT commands or the PDP startup procedure. The storage of context information in the SIM is not 
considered in the present document. Rules concerning what values shall be sent by the MT to the network under various 
circumstances are given in 3GPP TS 23.060. 

One particular rule that is designed to simplify operation in modem compatibility mode is that if there is only one PDP 
context subscription in the HLR then all of PDP type, PDP address and APN may be omitted. 

12.1.2.1 PDP type 

This may be omitted: 

when the MT supports only one PDP type (it will be provided by the MT); or 
according to the rules given in 3GPP TS 23.060. 

1 2.1 .2.2 PDP address (of the MS) 

This shall be omitted when: 

- a dynamic address is required; or 

according to the rules given in 3GPP TS 23.060. 

1 2.1 .2.3 Access Point Name 

This may be omitted: 

according to the rules given in 3GPP TS 23.060. 

12.1.2.4 QoS Requested 

This may be omitted when: 

the default subscribed QoS is acceptable. 

When the application in the TE requires streaming or conversational QoS, then the MS shall at least explicitly request 
the traffic class and should explicitly request the guaranteed bit rate and the maximum bit rate. 
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1 2.1 .2.5 PDP Configuration Options 

These shall be omitted: 

when none are required for the PDP concerned; or 
according to the rules given for the PDP. 
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1 2.2 Example command sequences for dial-compatibility mode 
1 2.2.1 PPP in dial compatibility mode 



12.2.1.1 



Mobile initiated IP context activation 



In this mode of operation, the MT behaves like an originating modem and accepts the normal V.250 commands 
associated with placing and clearing a call to a dial-up PPP server. Although the procedures for setting up the IP context 
are initiated from the mobile end, IP-based sessions, for example the File Transfer Protocol (FTP), may be initiated 
from either end once the context is active. 

For this example it is assumed that: 

the user has subscribed to only one PDP context (of type IP) and therefore no context parameter values are 
needed; 

the MT supports only PPP at the MT-TE interface and therefore no layer 2 protocol need be specified. 

A possible sequence of events is: 

the MT begins in V.25 command state: 

TE -> MT: AT<Packet Domain-specific configuration commands, if required>; 

- MT -> TE: OK. 

the TE sends a dial command requesting the Packet Switched service: 

- TE -> MT: ATD*99#; 

- MT -> TE CONNECT. 

the MT enters V.250 online data state: 

- TE starts up PPP (LCP exchange); 

- TE -> MT: LCP Configure-request; 

- MT -> TE: LCP Configure-ack: 

PPP Authentication may take place (optional); 
- TE starts up IP (NCP for IP exchange): 

- TE -> MT: NCP(IP) Configure-request; 

MT <-> network: MT performs the PS-attach procedure if the MT is not currently attached; 
MT <-> network: MT performs the IP context activation procedure; 

- MT -> TE: NCP(IP) Configure-ack; 

TE <-> MT< - > network: IP packets may now be transferred. 
TE stops IP (optional): 

- TE->MT: NCP(IP) Terminate-Request ); this 
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MT<-> network: MT performs the IP context deactivation procedure); is 

- MT->TE: NCP(IP) Terminate-Ack ) optional. 
- TE stops PPP: 

- TE-> MT: LCP Terminate-Request; 

MT <-> network: MT performs the IP context deactivation procedure if it has not already done so; 

MT <-> network: MT may perform the PS-detach procedure if no other Packet Switched services are 
active; 

- MT -> TE: LCP Terminate-Ack. 

the MT returns to V.250 command state and issues the final result code : 

- MT -> TE NO CARRIER. 

The TE may recognise this as a return to V.250 command state. However, if it is using procedures intended for 
controlling modems, it may attempt to force a disconnect since in the modem case it cannot rely on the remote modem 
dropping the carrier. It will use some combination of: 

- TE -> MT: TE drops circuit 108/2 (Data Terminal Ready); 
TE -> MT: escape sequence (e.g. +++); 

- TE -> MT: ATH. 

The MT should respond according to V.250 even if it is already in command state. 

If the connection is lost at any time, the MT shuts down PPP, returns to V.250 command state and issues the final result 
code: 

- MT -> TE NO CARRIER. 

1 2.2.1 .2 Network requested IP context activation 

In this mode of operation, the MT behaves like an answering modem and accepts the normal V.250 commands 
associated with answering a call to a PPP server. Although the procedures for setting up the IP context are initiated from 
the network end, IP -based sessions, for example the File Transfer Protocol (FTP), may be initiated from either end once 
the context is active. 

Two example sequences of events are given, for the cases of automatic and manual answering: 

Case 1: automatic answering 

The MT begins in V.250 command state: 

TE -> MT: AT<Packet Domain -specific configuration commands, if required >. 

The TE sets automatic answering mode: 

- TE->MT: ATS0=1: 

MT <- > network: MT performs the PS-attach procedure if the MT is not currently attached. 
Subsequently: 

network -> MT: Request PDP Context Activation message; 

- MT -> TE: RING. 

The MT returns the intermediate result code: 

- MT -> TE CONNECT, 
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and enters V.250 online data state. 

The TE and MT perform the PPP and IP startup procedures which include the MT requesting the network to activate 
the IP context. 

Case 2: manual answering 

The MT begins in V.250 command state: 

TE -> MT: AT<Packet Domain -specific configuration commands, if required >. 
The TE sets manual answering mode and requests a PS-attach (if necessary): 

- TE -> MT: ATSO=0; 

- TE->MT: AT+CGATT=1; 

MT <- > network: MT performs the PS-attach procedure if the MT is not currently attached; 
network -> MT: Request PDF Context Activation message; 

- MT -> TE: RING. 
The TE answers manually: 

- TE -> MT: ATA; 

- MT -> TE CONNECT, 

and enters V.250 online data state. 

The TE and MT perform the PPP and IP startup procedures which include the MT requesting the network to activate 
the IP context: 

or the TE rejects the connection: 

- TE -> MT: ATH. 

and remains in V.250 command state. 
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Annex A (informative): 

Summary of AT commands for the Packet Domain 

This informative annex lists the AT commands for the Packet Domain that are fully described in 3GPP TS 27.007. 
Table A.1 : Summary of AT commands for the packet domain 



Command 


Description 


+CGACT 


PDP context activate or deactivate 


+CGANS 


IVIanual response to a networl< request for PDP 
context activation 


+CGATT 


PS attach or detach 


+GGAUTO 


Automatic response to a networl< request for PDP 
context activation 


+GGCLASS 


PS mobile station class 


+CGCLOSP 


<VOID> 


+CGCLPAD 


<VOID> 


+CGDATA 


Enter data state 


+CGDCONT 


Define PDP context 


+CGEREP 


Control unsolicited PS event reporting 


+CGPADDR 


Show PDP address 


+CGREG 


Packet Domain network registration status 


+CGQMIN 


Quality of service profile (minimum acceptable) 


+CGQREQ 


Quality of service profile (requested) 


+CGSMS 


Select service for IVIQ SMS messages 



Table A.2: Summary of Packet Domain Extensions to existing GSM AT commands 



Command 


Description 


+CEER 


Extended error report (refer to 27.007) 


+CMEE 


Report mobile equipment error (refer to 27.007) 


+CR 


Service reporting control (refer to 27.007) 


+CRC 


Cellular result codes (refer to 27.007) 



Table A.3: Summary of AT commands for Packet Domain modem compatibility mode 



Command 


Description 


A 


Answer - manual acceptance of a network request 
for PDP context activation 


D 


Dial - request Packet Domain service 


H 


Qn-hook - manual rejection of a network request for 
PDP context activation 


SO 


Automatic answering control - automatic acceptance 
of a network request for PDP context activation 
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Annex B (informative): 

Octet Stream Protocol (OSP) PDP type 

Void 
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Annex C (informative): 
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